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9. The method of clairn^, wherein mapping further 
comprises : 

processing the captured N^P packet . 

10. The method of claitf\9, wherein the processing 
comprises : 

using header information to map th^ flow to a flow 
stored in a local store, 



11. The method of c 

includes a flow key. 





0, whereim the header information 



12. The method of claiK 11, v/herein the local store stores 

for the stored flow, flow state information including a flow key 
associated with metrics and st§/ce information, and wherein 
processing further comprises 

matching the flow /key to the flow key of the stored 

flow. 



13. The method of/claim 12, wherein processing further 

comprises : 

using the filow to update the metrics and the state 
information of the sxoredxflow. 



14. The method of claim rS, wherein processing further 

comprises : 

providing an accounting record to the accounting 
application, /the accounting record reflecting having updated the 
metrics and/the state information of the stored flow. 
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►11, wherein processing further 



15. The method of clc 

comprises : 

storing flow state information in association with the 
flow key for the flow in the local store if the header 
information cannot be jxsed to map the flow to a stored flow. 



16. A method of analyzing a flow ^or an accounting 

application, comprising : 

mapping network control in/ormation to user request 
information of the flow; and 

producing a current accounting record of the flow from 
the results of the mapping. 



17. The method or c 

providing the c^utftent 
accounting application . 



6, further comprising: 
ccounting record to the 




18. A computer prograpft ppa^Tuct residing on a computer-readable 
medium for analyzing /a flow for an accounting application, 
comprising instructions to cause a computer to: 

map pro/ocol information of a first protocol type to 
protocol information of a second, independent protocol type for 
the flow; and 

usef results of the mapping to provide well-informed 
accounting /information related to the flow to the accounting 
application. \ 

The computer program product of claihi 18, wherein the 
structions to cause a computer to map protocol information 
further comprise instructions toNcause a computer to: 
capture an IP packet froflsj a network segment; 
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determine if tl\e captured IP packet includes a message 
of the first protocol type for providing error reporting, the 
message having an embedded\lP packet that triggered an error 
event, the embedded IP packet being of the second protocol type 
and having a flow associated\ therewith; and 

correlate the flow associated with the embedded IP 
packet to a stored parent flovAof a given state to associate the 
error event with the given state of the stored parent flow. 



0. The computer program product \>f claim \L8 , . wherein the first 
protocol is the Internet Control Message Protocol, 



21. The computer program product of ^laipi 18, wherein the second 
protocol type is the Transmission Cont\ol Protocol. 

22. The computer program product o\ c^aim 18, wherein the 
first protocol type is the Internet Control Message Protocol and 
the second protocol type is the Transmission Control Protocol, 



23. A system for flow of ijetwork packet data, comprising: 
a processor; 

a ^memory sto^?lng^a computer program product residing on 
a computer-readable nefedium for analyzing a flow for an accounting 
application, comp^^ing instructions to cause a computer to: 

map prptocolL information of a first protocol type to 
protocol inf orn^iojar of a second, independent protocol type for 
the flow; and, 

provide accounting information related to the flow and 
based on tne map of the protocol information to the accounting 
application . 
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4. The system of claim* 23 Wherein the instructions to cause a 
computer to map protocol information further comprise 
instructions to cause a computer to: 

capture an IP packet Yfrom a network segment; 
determine if the captured IP packet includes a message 
of the first protocol type for providing error reporting, the 
message having an embedded IP paclcet that triggered an error 
event, the embedded IP packet being\of the second protocol type 
and having a flow associated therewith. 




25. The system of clairH 24 wherein the instructions to 
cause a computer to ma^Kprc/tocol information further comprise 
instructions to cause a c<z5mfc^iter to: 

correlate the /^low/associated with the embedded IP 
packet to a stored pare^nt^flow of a given state to associate the 
error event with the ^given^tate of the stored parent flow. 

26. The system of claim\23 wherein the first protocol is 
the Internet Control Message Protocol. 




27. The system of claim. 23 wherein the second protocol type 

is the Transmission\Control Protocol 



28. The system of clXim 23 wherein the first protocol type 

is the Internet Control Message Protocol and the second protocol 
type is the Transmission Control ProtocoJ 



REMARKS 

A check in payment for the excess claims fees required 
is enclosed. 
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